Intrusion Detection Systems

learn more… | top users | synonyms (2)

6
votes
3answers
616 views

How could malware like Stuxnet be detected?

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the ...
1
vote
2answers
163 views

Can IPS system be used as IDS and vice versa

I would like to know can an Network Intrusion Prevention System[IPS] be used as an Network Intrusion Detection System[IDS] and vice versa. Can the Host based IPS be used as a host based IDS and vice ...
1
vote
2answers
376 views

Suricata IPS rules for honeypot

I have a really simple high interaction honeypot and I have just installed a VM as an IPS (suricata) with a transparent bridge between my router and the honeypot. The setup looks something like this: ...
2
votes
1answer
1k views

IPS fail close vs IPS fail open, what are the risks and benefits?

If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes: 1- ...
1
vote
0answers
77 views

Alert correlation benchmark [closed]

I'm looking for some alert correlation tool to reduce number of alerts about 50%. It should support IDMEF. I googled for alert correlation tools but just found ACARM-ng, TIAA and MACE and all of them ...
2
votes
3answers
336 views

Make OSSEC ban ip on remote firewall

I am deploying OSSEC architecture agent-server mode. I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server). I've seached on the OSSEC's ...
1
vote
0answers
77 views

State transition Analysis Technique

As far as I have read and understood STAT is a concept used to design a platform independent IDS. My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
1
vote
2answers
909 views

Sending Syslog/SNMP information over the internet using standard UDP port 514

I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
1
vote
1answer
312 views

WAF testing frameworks

How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
4
votes
2answers
748 views

Event monitoring for a home network

I'd like to utilise some of the free SIEM type products out there to increase the chances that I will detect attacks and compromises of any of the devices on my home network. Most of my home devices ...
-1
votes
1answer
75 views

What steps are performed when a serious event reaches an Intrusion Detection System? [closed]

For example, you are using Snort and you just got a serious event, which states that a certain service is attacked. What do you do with the threat source IP? What are the steps that network event ...
-2
votes
2answers
78 views

Block all kind of querys from ip [closed]

I want to check my network intrusion detection system (physical intrusion like unauthorized gadgets or devices in wifi/ethernet). Until now everything is ok, but I was wondering if I block every query ...
6
votes
2answers
456 views

Detecting Pass-the-Hash

I was wondering what you guys are doing to detect attacks like Pass-The-Hash within your network. I've read about Breachbox ...
6
votes
3answers
282 views

Out-of-the-box Network Intrusion Appliance for non-Power User

First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources. Also, I understand if ...
1
vote
1answer
1k views

What is the best place to put my IDS network sensor? [duplicate]

I can only place a single network sensor somewhere within my network. Would it be best placed between the border router and firewall, or between the firewall internal LAN?
2
votes
0answers
257 views

Security Onion:snorby alerts shows all local nerwork source IP(public and private)

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
2
votes
1answer
3k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
3
votes
2answers
596 views

Example of malware that spreads via USB? [closed]

I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
4
votes
1answer
115 views

Security / logging on a Xen-based VPS instance?

Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
0
votes
1answer
69 views

How to specify a Snort rule connection duration?

Is it even possible to specify into a snort rule the duration of a connection? For example: in this format Hour, Minute, Second H, M, S = 0, 2, 1 If a connection that has the duration of 2 minutes ...
2
votes
1answer
531 views

How to add wildcards to snort rule ip address?

Is it possible to add wildcards or something that would function like them to a snort rule IP address? For example: If I'd like to detect source-ip of: 192.168.*.9 Where the third octet can be ...
5
votes
1answer
129 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
1
vote
2answers
332 views

SYN scan, TCP packet question

during SYN scans, many small tcp packets are sent to multiple ports to determine which ports are open or not. But when you're streaming media, aren't you receiving many One type of ID system, the ...
3
votes
1answer
924 views

Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not. I will present my findings so far here, but it will be good if you guys can confirm ...
4
votes
2answers
4k views

Snort (IDS) Don't show Port Scans

I have install Snort & acidbase by this instruction and access it through this local address 127.0.0.1/acidbase/base_main.php The problem is after scan it with nmap by this command sudo ...
2
votes
1answer
565 views

snort ignores packets with matching src/dest IP address

This is my rule: alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;) I am running snort against a precaptured packet file where there are UDP packets that ...
1
vote
2answers
270 views

Intrusion Prevention Systems: NIPS vs NBA

I was going through the wikipedia article on Intrusion Prevention Systems. It states two of the four types of IPS as follows: Network-based intrusion prevention system (NIPS): monitors the entire ...
3
votes
2answers
440 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
-1
votes
1answer
731 views

Solutions to TCP FIN Host Sweep (Signature 3032)

The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
3
votes
1answer
1k views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
1
vote
1answer
720 views

Snort, add TCP retransmission rule

Can somebody help me with adding rule for packet retransmission. I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
5
votes
2answers
306 views

How did Evernote detect the security breach?

http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/ Evernote's official message says little about technical details of the attack and how it was detected. ...
1
vote
1answer
312 views

how to handle error reply messages?

For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the ...
1
vote
1answer
199 views

How to capture packet using agent in JADE (Java Agent Development Framework)?

I need to design an IDS using Mobile agent. Can anyone suggest how packet capture software is efficient in JADE, how to match the captured packet for intrusion?
1
vote
2answers
464 views

What type of data does Snort log?

This is new to me, but what types of data does Snort log for Network Intrusion Detection? I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
2
votes
1answer
196 views

Does Verizon Wireless LTE network have intrusion prevention capabilities?

Can someone tell me whether or not Verizon Wireless's LTE network has an IDS/IPS capability? I'm trying to compare the security of their CDMA/LTE network to others that are GSM. EDIT for clarity: I ...
5
votes
1answer
121 views

Symbiote Counter-Attack Detection

I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
1
vote
1answer
818 views

How to find IPS events in sonicwall syslog

I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
1
vote
1answer
137 views

how to protect from Network scanner on android?

How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot. My question is: which scanners they use? how can i detect such scanners? Can i protect ...
1
vote
2answers
630 views

Where can I find worm traffic sample?

I have a program that has to detect scanning activity of worms. I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
2
votes
2answers
2k views

What approaches are to detect DoS attack in IDS/Firewall?

First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
0
votes
1answer
310 views

Network anomaly detection or anomaly-based intrusion detection?

When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should ...
-3
votes
2answers
148 views

anomaly detection: feature calculation problem [closed]

I have a question about how to calculate features selected in [ 1 ]. It assumes that the impact of DoS attack on features are nSrcs=nDsts=1, nPkts/sec>a, nSYN/Pkts>b, ... (Table 1 of [ 1 ]) ...
0
votes
1answer
203 views

Why unsupervised anomaly-based intrustion detection training data should be normal or less noisy

I recently read a paper which stated that "Traditional anomaly detection algorithms require a set of purely normal data from which they train their model" [1]. But as in K-means, or other unsupervised ...
0
votes
1answer
225 views

How does an IDS system use PCAP to process malicious signatures?

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
0
votes
1answer
748 views

Why aren't anomaly-based intrusion detection schemes implemented in Snort?

I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
3
votes
1answer
392 views

Anomaly Intrusion Detection relevant features

I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic. I found 41 features from KDD CUP'99 project (the paper: WENKE ...
1
vote
3answers
1k views

Using an IPS as an alternative to mod_security

I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
2
votes
2answers
326 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
0
votes
1answer
594 views

Interpreting Snort's stream5 alerts

I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index. Snort is showing me a huge amount of, in particular, these two ...